Understanding Solana Program Derived Addresses (PDAs)

Program derived addresses are one of the smartest parts of Solana's account model, and one of the most confusing when you first meet them. A PDA looks like any other address, but it was built so that no private key exists for it. This post explains what that means and why programs rely on it.

An address that is off the curve on purpose

An ordinary Solana address is the public key of an ed25519 keypair. It comes from a private key, and only the holder of that key can sign for it. These addresses always lie on a particular elliptic curve.

A PDA is built to lie off that curve. It's computed from some "seeds" and the program's own address. Seeds are bytes the program chooses, often a user's wallet address or a short label. The derivation function searches for a result that can't match any valid private key. What comes out is a valid Solana address that nobody can sign for with a key, the program's developers included, because no such key exists.

Why you'd want an address nobody can sign for

It sounds like a limitation, but it's the reason PDAs exist. A program can still "sign" for a PDA it derived. It doesn't use a key. It shows, inside its own instruction, that it derived that exact address from its program ID and the expected seeds. That lets a program own and control an account with the same authority a person has over a wallet, while no key exists that could be leaked, phished or used outside the program. Only that program's code, running its own instructions, can act on the account.

Where you've already met one

• Associated token accounts (ATAs). The token account that holds, say, your USDC is a PDA, derived from your wallet address, the token's mint address and the token program's ID. That's why any app can work out your ATA for a token without asking you. Everything that goes into it is public.
• Metaplex metadata accounts. A token's on-chain metadata (name, symbol, logo URI) sits at a PDA derived from the Metaplex program's ID and the mint address. That's how every wallet and explorer finds a token's metadata without a central list.
• Stake pools and program vaults. Many programs that hold pooled funds, such as staking protocols, lending pools and escrows, use a PDA as the vault. Only the program's code can move funds out, and there's no key anywhere that someone could steal.

How to tell if an address is a PDA

Because a PDA is off the curve, you can check it mathematically. Does the address correspond to a valid point on the ed25519 curve or not? An off-curve address that holds data and belongs to a program is almost certainly a PDA that program derived. An on-curve address holding program-owned data is a different and less common case. Usually it's an account created with a normal keypair and then handed to a program through its owner field.

It's easy to get this wrong unless the on-curve check is done explicitly. Without it, a wallet can be mistaken for a PDA, or a PDA for a wallet.

Why it matters to you

Say a protocol holds your funds in what it calls a "vault". If the vault is a PDA, only the program's code can move the funds, and you can prove that. If it's an ordinary address, a person holds the private key and can withdraw. That's a real difference in trust, and you can check it yourself.

Account Inspector tells you whether an address is on the curve (an ordinary key) or a PDA, and what kind of account it is. The Account Inspector docs have the details.